20 lines
1 KiB
Markdown
20 lines
1 KiB
Markdown
# CLEAN — Apache Thrift
|
|
Scanned 2026-03-29 for CWE-407.
|
|
|
|
## Scope
|
|
|
|
- `lib/java/src/main/java` — Java runtime library (PartialThriftComparer, TBase implementations)
|
|
- `compiler/cpp/src/thrift/parse/` — C++ IDL compiler (t_scope.h, t_program.h, t_const_value.h)
|
|
|
|
## Findings
|
|
|
|
| Location | Pattern | Type | Result |
|
|
|----------|---------|------|--------|
|
|
| `PartialThriftComparer.areEqual` (Set path) | `s2.contains(e1)` in loop over s1 | `s2` is `Set<Object>` (Java Set semantics per Thrift spec) | CLEAN |
|
|
| `t_scope.h` | `types_.find`, `services_.find`, `constants_.find` | `std::map` — O(log N) | CLEAN |
|
|
| `t_program.h` | namespace lookups | `std::map` | CLEAN |
|
|
| `contrib/thrift-maven-plugin` | `thriftPathElements.contains` | Called once per directory during classpath building, not in hot loop | LOW |
|
|
|
|
The Java library is minimal and the C++ compiler uses `std::map` (ordered map, O(log N) find). No quadratic list-membership pattern exists in the production hot path.
|
|
|
|
**Result: No actionable CWE-407 defects.**
|